Project: 
SpamSpan filter
Project machine name: 
spamspan
Date: 
2020-January-22
Security risk: 
Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Cross site scripting
Affected versions: 
1.0.0
Description: 

The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.

This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.

This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.

Solution: 

Install the latest version:

Also see the SpamSpan filter project page.

Reported By: 
Fixed By: 
Coordinated By: